The Right to Be Forgotten (Google v. Spain)

Summary

In Google v. Spain, the European Court of Justice ruled that the European citizens have a right to request that commercial search firms, such as Google, that gather personal information for profit should remove links to private information when asked, provided the information is no longer relevant. The Court did not say newspapers should remove articles. The Court found that the fundamental right to privacy is greater than the economic interest of the commercial firm and, in some circumstances, the public interest interest in access to Information. The European Court affirmed the judgment of the Spanish Data Protection Agency which upheld press freedoms and rejected a request to have the article concerning personal bankruptcy removed from the web site of the press organization.

When Europe’s highest court ruled in May that individuals had a “right to be forgotten”—i.e., they have the right to request that outdated or “irrelevant” information about them be removed from search results—the shockwaves were heard around the world.

Given the First Amendment and the traditionally strong emphasis on the public’s right to know in American culture, it may be difficult to imagine such a ruling happening stateside. But American culture is also traditionally strong on protecting privacy—and in fact, in January 2015, variant legislation applicable only to minors will become law in California. What if U.S. citizens start demanding the right to be forgotten, too?

We at Software Advice were intrigued by the possibility, so we surveyed 500 adults in the U.S. to find out how they felt about the right to be forgotten and the problems the law seeks to address. We then quizzed a panel of experts for their opinions on this complex issue.

Key Findings:

Sixty-one percent of Americans believe some version of the right to be forgotten is necessary.

Thirty-nine percent want a European-style blanket right to be forgotten, without restrictions.

Nearly half of respondents were concerned that "irrelevant" search results can harm a person’s reputation.

Top News

UK Government Releases Statement of Intent Describing New Data Protection Bill: The UK has released a statement of intent describing a forthcoming bill that would make major revisions to the the country's data protection law. The new rules would follow the EU's General Data Protection Regulation by strengthening rules for obtaining consent, making it easier for consumers to withdraw consent, and improving consumers' ability to access, move, and remove data about themselves. The bill would also expand the definition of "personal data" to include DNA and IP addresses and would make it a crime to re-identify individuals from anonymized data. EPIC supported the GDPR and the right to be forgotten, has explained that IP addresses are personal data, and has warned of the risks of improperly "de-identified" data. EPIC recently filed a complaint asking the FTC to investigate Google's use of a proprietary, secret algorithm Google claims can "de-identify" consumers while tracking their purchases. (Aug. 10, 2017)

Google Concedes "Right to be Forgotten" Applies Worldwide: After waging an unproductive battle against the privacy rights of Internet users, Google will finally remove links to sensitive personal information. Google had challenged the legal authority of the Spanish people to protect their personal information, but lost the case Google v. Spain before the top court in Europe. Google then claimed that the links to personal data should only be removed in the country where the Internet user resided. Privacy experts said Google's position made no sense for the "global Internet." The French data protection agency threatened Google with sanctions. Google again fought back, claiming it did not need to comply with decision of the Court of Justice of the European Union. Now the company has decided to comply with the law. (Feb. 11, 2016)

Nearly all of the "right to be forgotten" requests made to Google up to March 2015 came from everyday members of the public seeking to remove links to private information. The new data, accidentally embedded in the source code of Google's transparency report, show that just five percent of the nearly 220,000 delinking requests concerned criminals, politicians, or public officials. This revelation undercuts claims by Google and some media companies to sensationalize the right articulated by the Court of Justice of the EU last year. EPIC has defended the right to delink and argued that the right should be recognized in the United States.

French authorities have threatened Google with fines if it fails to apply Europe's right to be forgotten ruling to the search engine's global domains, including Google.com. Google has been reluctant to apply the landmark decision broadly, even after officials across Europe made clear that Google is violating the court judgement if it routinely discloses sensitive personal information to Internet users worldwide. EPIC explained in US News & World Report and USA Today that Google's position is illogical and inconsistent. According to a recent survey, nine out of ten voters in the United States want the right to delete links to personal information.

According to a new survey, nine out of ten voters in the United States want the right to delete links to personal information. Those voters say they would support a U.S. law that permits Internet users to ask search companies, such as Google, to remove links to certain personal information. Last May the top court in the European Union established the "right to be forgotten" as a fundamental right, protected by the EU Constitution. EU citizens may require search companies to remove personal information that is inadequate, irrelevant, and inaccurate. The recent US survey bolsters the findings of a previous US survey which found that 61% of Americans supported the right to be forgotten. EPIC has argued that the right should be established in the United States.

Privacy regulators in the European Union have issued guidelines calling for the recent "Right to be Forgotten" ruling to apply worldwide. In May, the European Union Court of Justice ruled that a European Union citizen can ask search engines to remove links in search results based on the citizen's name. However, Google chose to remove the links for only certain domains, leaving the private information subject to the ruling accessible to most users. The new report makes clear that the ruling should apply across all search engine services. The EU officials explain, "limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights of data subjects according to the ruling." For more information, see Fact Sheet on the Right to Be Forgotten, EPIC: Right to Be Forgotten, EPIC: International Privacy Law, EPIC: Expungement.

A federal appeals court ruled that the government violated the Fourth Amendment when investigators searched computer files that had been seized in an unrelated investigation more than two and a half years earlier. The Second Circuit found that the government has a duty to delete all files not responsive to the original warrant and cannot indefinitely retain data "for use in future criminal investigations." This rule imposes a data minimization requirement on law enforcement investigators and is similar also to the much discussed "right to be forgotten." EPIC argued in favor of the data minimization principles adopted by the Ninth Circuit in US v. Comprehensive Drug Testing. For more information, see United States v. Ganias, EPIC: Quon v. City of Ontario, CA and EPIC: Code of Fair Information Practices.

The European Court of Justice has upheld the "right to be forgotten" and ruled that Google must delete links upon request concerning private life. The Court also determined that companies are subject to the EU Data Protection Directive and that jurisdiction extends to companies that set up a branch in an EU state. The Court said that since privacy is a fundamental right, it overrules the economic interests of the company and the public interest in access to the information. However this is not the case concerning one's activity in public life. EPIC has broadly supported the privacy rights of Internet users and the specific right to "expunge" information held by commercial firms. For more information, see EPIC - In re Facebook, EPIC - Expungement, and EPIC - G.D. v. Kenny.

Background

Procedural History

In 2010 Mario Costeja González, filed a complaint with the Agencia Española de Protección de Datos (AEDP), the Spanish Data Protection Agency, against a local newspaper and Google Spain for claims relating to auction notices mentioning González published in 1998. The notices concerned real estate auctions held to secure repayment of González's social security debts. González contended that these pages were no longer necessary because "the attachment proceedings concerning him had been fully resolved for a number of years and that reference to them was now entirely irrelevant." He sought to have the local newspaper, La Vanguardia, remove the pages or alter them so his personal information was no longer displayed. He also sought for Google Inc. to remove the links to the articles in question so that the information no longer appeared in Google Search results.

The AEDP dismissed the plaintiff's claims against the newspaper, but allowed those against Google. Google appealed to Spain's high court, which in turn referred three questions to the ECJ:

(1) Whether EU rules apply to search engines if they have a branch or subsidiary in a Member State;

(2) Whether the Directive applies to search engines; and

(3) Whether an individual has the right to request that their personal data be removed from search results (i.e. the "right to be forgotten").

ECJ Decision

The ECJ first ruled that the Directive applies to search engines. The Directive sets forth rules for "controllers" involved in the "processing of personal data." The ECJ held that search engines engage in "processing of data" because they explore the internet "automatically, constantly and systematically in search of the information." The ECJ further held that search engines are "controllers" within the meaning of the Directive because search engines "determine[] the purposes and means of" data processing.

Second, the Court concluded that because Google Inc. had a subsidiary (Google Spain) operating within the territory of Spain (a Member State), even though Google itself is based within a non-member state (the United States), the directive properly applied to Google and Google operated as "an 'establishment' within the meaning of the directive." The Court concluded this despite Google's assertion that the data was not processed within Spain, because Google intended to "promote and sell, in the Member State in question, advertising space offered by the search engine in order to make the service offered by the engine profitable." For these reasons, ruled the Court, Google has an obligation in certain cases to remove the links to pages displayed by third parties, even if the information published by those third parties is itself lawful.

Third, the ECJ held that individuals have a right to request search engines to remove links to personal information. The Court held Article 12(b) of the Directive gives individuals the right to ask search engine operators to erase search results that are incompatible with Article 6. Article 12(b) of the Directive give data subjects the right to "rectification, erasure or blocking of data the processing of which does not comply with the provisions of [the] Directive." Article 6 requires that data is "adequate, relevant and not excessive in relation to the purposes for which they are collected", "accurate and, where necessary, kept up to date", and "kept in a form which permits identification of data subjects for no longer than necessary." The Court also made clear that it is not necessary to find that links cause prejudice to the data subject. The Court held that "a fair balance should be sought in particular between that interest and the data subject's fundamental rights." However, "those rights override, as a rule, not only the economic interest of the operator of a search engine but also the interest of the general public in finding that information . . . ." This balance would vary on a case-by-case basis and may depend on "the nature of the information in question and its sensitivity for the data subject's private life" and the public's interest in the information. The public's interest, in turn, may vary depending on whether the individual is a public figure. According to the Court, Google's economic interest and the public's interest in links to Gonzalez's auction notices did not outweigh the serious interference with Gonzalez's fundamental rights under the Directive.

EPIC's Related Work

The social consequences of a criminal record can lead to the denial of an individual's right to civic participation. Life, subsequent to an arrest, is permanently altered. Regardless of whether an individual has been convicted, an arrest or citation typically persists on a criminal record. Therefore, even a person who has had the charges against them dropped may be subject to a degree of social ostracism and a de facto public finding of guilt. Some states permit individuals who are arrested, but not convicted, to expunge their arrest records. Others permit some convicts to apply for expungements after time has passed from the completion of their sentences.

In G.D. v. Kenny, a case raising both defamation and privacy tort claims, the Supreme Court of New Jersey has held that defendants are entitled to assert truth as a defense, even when the relevant facts are subject to an expungement order under a state statute. The Court relied on the fact that criminal conviction information is disseminated before the entry of an expungement judgement. In an amicus brief, EPIC had urged the New Jersey Supreme Court to preserve the value of expungement and further argued that data broker firms will make available inaccurate and incomplete information if expungement orders are not enforced by the state. The case may have implications for the "Right to be Forgotten."